OpenAPI schema validation enhancement (7.6.3)

FortiWeb has enhanced OpenAPI schema validation with stricter media type handling, default charset enforcement, and improved logging. These enhancements address potential security bypass issues by ensuring proper validation of media types beyond application/json.

Key Enhancements

Media Type Routing

• FortiWeb now determines WAF validation flow based on the Content-Type header in the request and its corresponding entry in the OpenAPI Specification (OAS) document.

• Exact matching is enforced.

Expanded JSON Media Type Support

• text/json is now included as a built-in JSON media type, improving compatibility with common API implementations.

Default Charset Enforcement

• If no charset is specified in the Content-Type header, FortiWeb defaults to UTF-8 for JSON-based media types.

Vendor Implementation Extension (x-is-json)

• A new x-is-json boolean property is introduced in the Media Type Object to extend JSON-type recognition.

• When x-is-json: true, FortiWeb treats the content as JSON, even if the media type does not explicitly match application/json or text/json.

User-Configurable Handling for Unlisted and Non-JSON Media Types

New CLI options in config waf openapi-validation-policy:

config waf openapi-validation-policy
  edit <openapi-validation-policy-name>
    set inherit-action-for-non-JSON-media-types {enable|disable}  // Default: enable
    set inherit-action-for-unlisted-media-types {enable|disable}  // Default: enable
    config schema-file
      edit <rule-id>
        set openapi-file <openapi-file-name>
      next
    end
  next
end

• inherit-action-for-unlisted-media-types (Default: Enabled)

  Controls whether to apply the default action for media types not listed in the OAS document.

• inherit-action-for-non-JSON-media-types (Default: Enabled)

  Determines handling for media types without x-is-json: true, treating them as non-JSON.

Backward Compatibility

• Existing OpenAPI schema files remain functional without reprocessing.

Logging Enhancements

Three new logs provide visibility into validation actions:

• Unlisted-Media-Types: Logs requests with media types not specified in the OAS document.

• Non-JSON-Media-Types: Logs requests with media types not recognized as JSON.

• Charset Violation: Logs requests that do not conform to the UTF-8 charset requirement.